video-to-shorts

• Outcome: Pass
• Latest audit: Oct 7, 2026 · 4:30 AM UTC
• Version: 1.0.5

Overview

This skill is a disclosed local video-editing workflow that reads project media/transcripts, generates review artifacts, and only delivers shorts after explicit review gates.

Install this only for local video projects where you are comfortable letting the agent read media/transcripts, run ffmpeg/ffprobe, and write work, review, cache, and final shorts outputs. Review the generated candidate and vertical pages before approving delivery, and run it on a project copy if the source media or project metadata is sensitive.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description refers to short-form candidate planning/approval and delivery workflows for Project Protocol videos. However, the supplied code does not perform planning, approval handling, extraction, or reviewed 9:16 delivery. Its concrete purpose is transcript preparation: loading or generating transcripts, validating structure and timing, mapping transcripts onto a timeline, checking durations, and producing preview and metadata artifacts. While transcript preparation may support a shorts workflow, the implemented behavior is a distinct preprocessing utility and omits the workflow functions described. Therefore the description does not accurately represent this code chunk's primary behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description focuses on workflow steps for short-form video production and delivery (candidate planning, approval, horizontal extraction, reviewed 9:16 delivery). The supplied code instead has a narrow utility purpose: producing deterministic visual review artifacts (sampled frames, contact sheets, and a manifest) from a video. While this could support review in a broader video pipeline, it does not implement the described primary functions such as planning, approvals, extraction variants, or final delivery. Therefore the description does not accurately represent this code chunk's actual behavior.

Content

No source excerpt is available for this finding.

Direct flow: pathlib.Path.read_bytes (file read) → pathlib.Path.write_bytes (file write)

High

• Category: Data Flow
• Confidence: 80% confidence

Finding

Data flows directly from a source (env vars, files, network) to a sink (network output, exec, file write) without intermediate validation.

Content

Scanner excerpt · scripts/check_review_ui.py (reported line 800)May include surrounding context.

python

self.assertEqual(before, {path: path.read_bytes() for path in before})
            review_gate.verify_vertical_artifacts(first_review)

            first_preview.write_bytes(first_preview.read_bytes() + b"changed")
            with self.assertRaisesRegex(SystemExit, "changed after review"):
                review_gate.verify_vertical_artifacts(first_review)

Direct flow: pathlib.Path.read_bytes (file read) → pathlib.Path.write_bytes (file write)

High

• Category: Data Flow
• Confidence: 80% confidence

Finding

Data flows directly from a source (env vars, files, network) to a sink (network output, exec, file write) without intermediate validation.

Content

Scanner excerpt · scripts/check_review_ui.py (reported line 857)May include surrounding context.

python

)
                review_gate.answer_vertical_review(fixture["source"].parent, response)
                artifact_path = Path(load_json(review_path)["artifacts"][label]["path"])
                artifact_path.write_bytes(artifact_path.read_bytes() + b"changed")
                candidate = {"review_id": "candidate-review-1"}
                with mock.patch.object(
                    review_gate, "validate_vertical_delivery_allowed",

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/check_review_ui.py (reported line 1215)May include surrounding context.

python

self.assertTrue((vertical_root / "review" / "short-001-vertical-review-review-id.html").is_file())
            self.assertTrue((vertical_root / "review" / "short-001-vertical-review.html").is_file())
            self.assertFalse(list((vertical_root / "preview").glob("*.html")))


class ExplicitPlannerSelectionTests(unittest.TestCase):
    def test_explicit_selection_rejects_any_deterministic_drop(self):
        import plan

        rejected = [
            ({"candidate_id": "cand-002"}, {"errors": ["LOW_SCORE", "SHORT_DURATION"]}),
            ({"candidate_id": "cand-003"}, {"errors": ["OVERLAPS_HIGHER_SCORE"]}),
        ]
        with self.assertRaisesRegex(SystemExit, r"cand-002.*LOW_SCORE.*SHORT_DURATION.*cand-003.*OVERLAPS_HIGHER_SCORE"):
            plan.require_explicit_selection_survived("explicit_user_selection", rejected)
        plan.require_explicit_selection_survived("default_text_visual_top_five", rejected)


class BoundPlannerTranscriptTests(unittest.TestCase):
    de

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes Python and ffmpeg-based commands, reads project media/transcripts, and writes outputs, but it declares no explicit tool scope or permissions boundary. In an agentic environment, this increases the chance of unintended shell execution or broad filesystem access beyond what reviewers/users expect, especially because the workflow operates on user-supplied paths and generates many artifacts.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boundary_refine.py (reported line 370)May include surrounding context.

python

"null",
        "NUL",
    ]
    p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
    if p.returncode != 0:
        return [{"warning": "SCENE_DETECTION_FAILED", "message": p.stderr.strip()[-500:]}]
    cuts = []

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_project_protocol.py (reported line 329)May include surrounding context.

python

with tempfile.TemporaryDirectory() as temporary:
        root = Path(temporary)
        source = root / "source.mp4"
        subprocess.run([
            "ffmpeg", "-hide_banner", "-loglevel", "error", "-y",
            "-f", "lavfi", "-i", "testsrc2=size=320x180:rate=30000/1001:duration=4",
            "-f", "lavfi", "-i", "sine=frequency=440:sample_rate=48000:duration=4",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_project_protocol.py (reported line 389)May include surrounding context.

python

with tempfile.TemporaryDirectory() as temporary:
        root = Path(temporary)
        source = root / "source.mp4"
        subprocess.run([
            "ffmpeg", "-hide_banner", "-loglevel", "error", "-y",
            "-f", "lavfi", "-i", "testsrc2=size=320x180:rate=30000/1001:duration=4",
            "-f", "lavfi", "-i", "sine=frequency=440:sample_rate=48000:duration=4",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_project_protocol.py (reported line 342)May include surrounding context.

python

[{"start_time": 0.5, "end_time": 1.5}, {"start_time": 2.0, "end_time": 3.0}],
            has_audio=True,
        )
        subprocess.run(command, check=True, capture_output=True)
        horizontal_probe = render_vertical.probe_media("ffprobe", horizontal)
        assert any(stream.get("codec_type") == "audio" for stream in horizontal_probe["streams"])
        assert abs(float(horizontal_probe["format"]["duration"]) - 2.0) < 0.1

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_project_protocol.py (reported line 401)May include surrounding context.

python

{"start_time": 2.0, "end_time": 3.0},
        ]
        horizontal = root / "horizontal.mp4"
        subprocess.run(
            extract_shorts.build_extract_command(
                "ffmpeg", source, horizontal, keep_spans, has_audio=True,
            ),

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_project_protocol.py (reported line 660)May include surrounding context.

python

def check_workflow_ui():
    script = Path(__file__).with_name("check_review_ui.py")
    subprocess.run([sys.executable, str(script)], check=True)
    print("[shorts-protocol] bound workflow UI passed")

Tainted flow: 'raw' from pathlib.Path.read_bytes (line 1018, file read) → pathlib.Path.write_bytes (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/check_review_ui.py (reported line 1022)May include surrounding context.

python

data = json.loads(raw.decode("utf-8-sig"))
                entry = {"path": str(path), "sha256": hashlib.sha256(raw).hexdigest()}
                if label == "vertical plan" and not mutated:
                    path.write_bytes(raw + b" ")
                    mutated = True
                return path, entry, data, raw

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_shorts.py (reported line 30)May include surrounding context.

python

def run(command):
    process = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
    if process.returncode != 0:
        raise RuntimeError("command failed: " + " ".join(map(str, command)) + "\n" + process.stderr.strip())
    return process.stdout

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_transcript.py (reported line 25)May include surrounding context.

python

def run(command):
    process = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
    if process.returncode != 0:
        raise RuntimeError("command failed: " + " ".join(map(str, command)) + "\n" + process.stderr.strip())
    return process.stdout

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_visual_context.py (reported line 20)May include surrounding context.

python

def run(command):
    process = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
    if process.returncode != 0:
        raise RuntimeError("command failed: " + " ".join(map(str, command)) + "\n" + process.stderr.strip())
    return process.stdout

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_vertical.py (reported line 30)May include surrounding context.

python

def run(command):
    process = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
    if process.returncode != 0:
        raise RuntimeError("command failed: " + " ".join(map(str, command)) + "\n" + process.stderr.strip())
    return process.stdout

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/vertical_plan.py (reported line 28)May include surrounding context.

python

def run(command):
    process = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
    if process.returncode != 0:
        raise RuntimeError("command failed: " + " ".join(map(str, command)) + "\n" + process.stderr.strip())
    return process.stdout

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/review_gate.py (reported line 229)May include surrounding context.

python

"",
        "- Omit `候选:` or use `候选: 默认` / `候选: 跳过` to use the five highest-scoring `text_visual` candidates.",
        "- 不写 `候选:`，或回复 `候选: 默认` / `候选: 跳过`，将使用 `text_visual` 得分最高的 5 个候选。",
        "- To request changes without approval, reply `修改: <your request>`.",
        "- 如需修改候选且不批准，回复 `修改: <要求>`。",
        "",
        "Delivery choices / 交付模式:",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/review_gate.py (reported line 844)May include surrounding context.

python

tool = ffprobe or shutil.which("ffprobe")
    if not tool:
        fail("ffprobe is required to validate vertical preview media")
    process = subprocess.run([
        tool, "-v", "error", "-show_entries",
        "format=duration:stream=codec_type,width,height,avg_frame_rate,sample_rate,channels",
        "-of", "json", str(path),

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The file performs many writes such as write_bytes, write_text, and JSON output generation across several checks. Although these occur in TemporaryDirectory contexts and are expected for test fixtures, the file provides only a high-level module docstring and no explicit note that running it will create temporary media and review artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code launches external processes via subprocess.run to generate and transform media, and later also executes another script. While these operations fit a test/checking workflow, this file itself provides no visible print, prompt, or comment near the calls to disclose that external commands will be run.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The CLI defaults the fallback Whisper model to base.en and the language to en, which makes English the implicit output language unless the caller overrides it. This is a natural-language locale choice embedded in the skill behavior without explicit opt-in or interactive selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script writes multiple JSON, image, and video outputs and also deletes temporary directories via shutil.rmtree, but it does not present a confirmation prompt before doing so. Although some final paths are printed after execution, the code lacks an upfront user-facing disclosure that it will create and remove files in the specified output locations.

Content

No source excerpt is available for this finding.